Solution auth base

index.js

@@ -1,8 +1,9 @@
 import cors from "cors";
 import express from "express";
+import { auth } from "express-oauth2-jwt-bearer";
 
 import db from "./db/models/index.cjs";
-const { Listing } = db;
+const { Listing, User } = db;
 
 const PORT = 3000;
 const app = express();
@@ -13,15 +14,27 @@ app.use(cors());
 // Enable reading JSON request bodies
 app.use(express.json());
 
+// Authorization middleware. When used, the Access Token must
+// exist and be verified against the Auth0 JSON Web Key Set.
+const checkJwt = auth({
+  audience: "https://carousell/api",
+  issuerBaseURL: `https://dev-9o--f19k.us.auth0.com/`,
+});
+
 // Retrieve all listings. No authentication required.
 app.get("/listings", async (req, res) => {
   const listings = await Listing.findAll();
   res.json(listings);
 });
 
 // Create listing. Requires authentication.
-app.post("/listings", async (req, res) => {
-  // TODO: Get seller email from auth, query Users table for seller ID
+app.post("/listings", checkJwt, async (req, res) => {
+  // Retrieve seller from DB via seller email from auth
+  const [seller] = await User.findOrCreate({
+    where: {
+      email: req.body.sellerEmail,
+    },
+  });
 
   // Create new listing
   const newListing = await Listing.create({
@@ -32,7 +45,7 @@ app.post("/listings", async (req, res) => {
     description: req.body.description,
     shippingDetails: req.body.shippingDetails,
     BuyerId: null,
-    SellerId: 1, // TODO: Replace with seller ID of authenticated seller
+    SellerId: seller.id,
   });
 
   // Respond with new listing
@@ -46,11 +59,18 @@ app.get("/listings/:listingId", async (req, res) => {
 });
 
 // Buy specific listing. Requires authentication.
-app.put("/listings/:listingId/buy", async (req, res) => {
+app.put("/listings/:listingId/buy", checkJwt, async (req, res) => {
   const listing = await Listing.findByPk(req.params.listingId);
 
-  // TODO: Get buyer email from auth, query Users table for buyer ID
-  await listing.update({ BuyerId: 1 }); // TODO: Replace with buyer ID of authenticated buyer
+  // Retrieve seller from DB via seller email from auth
+  const [buyer] = await User.findOrCreate({
+    where: {
+      email: req.body.buyerEmail,
+    },
+  });
+
+  // Update listing to reference buyer's user ID
+  await listing.update({ BuyerId: buyer.id });
 
   // Respond to acknowledge update
   res.json(listing);

package.json

@@ -8,6 +8,7 @@
   "dependencies": {
     "cors": "^2.8.5",
     "express": "^4.18.1",
+    "express-oauth2-jwt-bearer": "^1.1.0",
     "pg": "^8.7.3",
     "sequelize": "^6.20.1"
   },